In the Recovery step, what is actually being restored — and what must accompany the restoration?

Restore the functionality of an entire business process and all its related systems (not just individual devices), backed by extensive testing.

Recovery is process-centric, not device-centric: the aim is full and reliable restoration of a business process and every system it depends on. It must include thorough testing to confirm three things: the affected systems are reliable and their data has integrity; they are correctly configured so the dependent process works again; and they are no longer compromised. Skipping the testing risks restoring a process on top of a still-infected system.